1. How we protect your data
- Secure account access: Session-based authentication with secure, httpOnly cookies. MFA and passkeys are on the roadmap for all internal admin roles before production launch.
- KYC protection: Identity numbers are stored encrypted and are displayed masked by default. Authorized personnel of the Company may access and process PAN and Aadhaar information only where necessary to resolve payment or transaction-related issues, comply with legal or regulatory obligations, or as otherwise permitted under applicable law.
- Access is limited and logged: Identifiers are shown masked across the platform. Where authorized personnel need the full value for a payment or a legal obligation, that access is restricted to those roles and each access is recorded in the audit trail.
- Audit logs: Logins, role changes, KYC decisions, document views, payout approvals, and privacy requests all write permanent audit events with actor, action, reason, and risk level.
- Role-based admin access: Access is limited by role, team, project, region, workflow state, and data sensitivity. Every server operation re-checks permissions; nothing trusts the browser.
- Consent history: Every consent is versioned and stored with its exact text and timestamp. Withdrawing an optional consent takes one click in your Privacy Centre.
- Worker Privacy Centre: A dedicated dashboard section to see what data we hold, request corrections or erasure, withdraw consents, raise grievances, and download an account summary.
- No broad raw document access: Viewing an identity document requires the compliance-specific capability, an explicit stated reason, and creates a high-risk audit event. Directors approve; they do not browse.
- Incident response: A security console tracks suspicious activity, failed logins, and incidents with owners and severity. Incident response runbooks are part of our production checklist.
2. What a manager sees vs what exists
When an operations manager opens your profile they see: your name, city, training status, quality score, and a label like "Verified" next to KYC. Identifiers are shown masked, for example "A/C ****4821" and "PAN ******82F". Full values are held in encrypted storage. Authorized personnel of the Company may access and process PAN and Aadhaar information only where necessary to resolve payment or transaction-related issues, comply with legal or regulatory obligations, or as otherwise permitted under applicable law, and every such access is logged.
3. Questions about how we protect your data?
Read the Privacy Policy, or write to our grievance officer. We answer.